Hi, Recently I started receiving spam from addresses that show up in Outlook mail client as info.qogo...@nwnsoyuqem.sicotti.nl or some other subdomain of sicotti.nl. I thought I could block these messages by adding @.sicotti.nl to the sender-blacklist-file but that didn't work. Upon further investigation in my server logs I see that the "from=" parameter shows nothing (ie. blank) as can be seen below. I'm guessing that is why my blocking attempt is failing. How do I block emails with no "from=" information?
Feb 13 16:42:12 ns3 /var/qmail/bin/relaylock[2062]: /var/qmail/bin/relaylock: mail from 52.252.134.30:43487 (adsfsdf-i25p.northcentralus.cloudapp.azure.com) Feb 13 16:42:13 ns3 qmail-queue-handlers[2065]: Handlers Filter before-queue for qmail started ... Feb 13 16:42:13 ns3 qmail-queue-handlers[2065]: from= Feb 13 16:42:13 ns3 qmail-queue-handlers[2065]: to=u...@domain.ca Feb 13 16:42:13 ns3 qmail-queue-handlers[2065]: handlers_stderr: INFO:__main__:No SMTP AUTH and not running in sendmail context (incoming or unrestricted outgoing mail). SKIP message. Feb 13 16:42:13 ns3 qmail-queue-handlers[2065]: handlers_stderr: SKIP Feb 13 16:42:13 ns3 qmail-queue-handlers[2065]: SKIP during call 'limit-out' handler Feb 13 16:42:13 ns3 check-quota[2071]: Starting the check-quota filter... Feb 13 16:42:13 ns3 qmail-queue-handlers[2065]: handlers_stderr: SKIP Feb 13 16:42:13 ns3 qmail-queue-handlers[2065]: SKIP during call 'check-quota' handler Feb 13 16:42:13 ns3 spf[2072]: Starting the spf filter... Feb 13 16:42:13 ns3 spf[2072]: SPF status: PASS Feb 13 16:42:13 ns3 qmail-queue-handlers[2065]: handlers_stderr: PASS Feb 13 16:42:13 ns3 qmail-queue-handlers[2065]: PASS during call 'spf' handler Feb 13 16:42:13 ns3 qmail-queue-handlers[2065]: starter: submitter[2073] exited normally Feb 13 16:42:13 ns3 qmail: 1613252533.502273 new msg 8150512 Feb 13 16:42:13 ns3 qmail: 1613252533.502305 info msg 8150512: bytes 1852 from <> qp 2073 uid 2020 Feb 13 16:42:13 ns3 spamdyke[2053]: ALLOWED from: (unknown) to: u...@domain.ca origin_ip: 52.252.134.30 origin_rdns: adsfsdf-i25p.northcentralus.cloudapp.azure.com auth: (unknown) encryption: (none) reason: $ Regards, Shane Bywater _______________________________________________ spamdyke-users mailing list spamdyke-users@spamdyke.org https://spamdyke.org/mailman/listinfo/spamdyke-users
